Check Point researchers detail Dok, OS X malware that uses a signed Apple developer certificate to bypass Gatekeeper
Don't be scared but be aware, there's a new malware in town and it wants your Mac. — Check Point Technologies has released detailed information about a a new malware attack that is directed at Mac users.
Context & Ripple Effects
Check Point's disclosure of Dok marks an early entry in what the related coverage shows is a recurring macOS problem: attackers defeating Gatekeeper not by breaking the OS, but by abusing its trust mechanisms. Dok's trick is borrowing a legitimately signed Apple developer certificate so the malware looks like vetted software.
The pattern keeps repeating after this report: OSX/Linker exploited an unpatched macOS flaw to skip Gatekeeper scanning in 2019, Apple had to revoke certificates tied to the Silver Sparrow creator's dev accounts in 2021, a months-long notarization bug was only closed in Big Sur 11.3, and in late 2022 Apple patched another Gatekeeper bypass reported by Microsoft. Dok is the template case for all of them.
First-order effects
- Mac users lose their main line of defense: Gatekeeper's check passes for Dok because the binary carries a valid developer signature, so the usual 'unidentified developer' warning never fires.
- Apple faces immediate pressure to revoke the abused developer certificate, since the signature itself — not any OS vulnerability — is what legitimizes the malware.
Second-order effects
- Certificate revocation becomes a live operational tool for Apple rather than a formality, forcing it to police its developer program as a security surface and pushing legitimate developers to guard their signing credentials like keys to the platform.
- Security researchers and rival vendors gain standing in the Mac ecosystem: Check Point's disclosure model, and Microsoft later reporting a macOS Gatekeeper bypass, show cross-company research filling gaps in Apple's own defenses.
Third-order effects
- If the pattern holds, Apple's trust chain — signing, notarization, Gatekeeper — becomes the primary battleground for macOS malware, shifting Apple's security work from patching OS flaws to actively managing and revoking identity credentials at scale.
- Each documented bypass erodes the long-standing marketing assumption that Macs are structurally safer from malware, pushing Apple toward more aggressive automated review of everything that runs on the platform.
The trend: macOS attacks are converging on Apple's software-identity infrastructure — developer certificates, notarization, and Gatekeeper — turning code-signing governance into the front line of Mac security.